CVE-2026-84906
Eventin < 4.1.24 - Unauthenticated Payment Bypass via Stripe and PayPal Cross-Order Transaction Replay
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The Eventin WordPress plugin before 4.1.24 does not verify that a completed payment corresponds to the order it is applied to, confirming only that the payment gateway reports the transaction as successful, not its amount, currency, or which order it belongs to, allowing unauthenticated visitors to mark unpaid orders of any value as paid by replaying the transaction of a single genuine low-value payment.
| Vendor | unknown |
| Product | eventin |
| Published | Sep 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown eventin
Be the first to know when new medium vulnerabilities affecting unknown eventin are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / Eventin
0 < 4.1.24
References
Credits
cyberkareem WPScan